What needs to be considered when using Microsoft Security Baselines?

In the context of hardening measures, it is a good idea to use the Microsoft published Microsoft Security Baselines to your own server landscape.

This will inevitably have an impact on PKI components. The following is an overview of the expected effects and countermeasures.

Auditing settings

The security baselines bring an auditing policy, which does not include settings for the certification authority (see article "Standard auditing rules for Windows Server operating systems" for a comparison with the standard auditing rules).

The certification authority-specific audit settings must therefore be applied separately to the certification authorities and the associated services. See article "Configuration of security event monitoring (auditing settings) for certification authorities„.

The security baselines include rules to prevent outdated (Internet Explorer) or Microsoft undesirable (Google Chrome, Mozilla Firefox) browsers from running. If these browsers are used, the configuration must be adjusted accordingly.